JP2012034169A - Packet authentication system, authentication method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system, authentication method, and program, in which a sender or a receiver of a packet can be authenticated for each packet without being provided with an authentication protocol different from the one for sending/receiving the packet and without a packet transfer capability being affected.SOLUTION: An authentication system comprises a first device and a second device that is connected with the first device through a first network. The first device includes: an authentication data embedding part for embedding authentication data in a data packet; and a packet transmission part for transmitting the data packet, in which the authentication data is embedded, to the second device. The second device includes: a packet reception part for receiving the data packet from the first device; an authentication data extraction part for extracting the authentication data from the received data packet; and a validity determination part for determining the validity of a sender or a receiver of the data packet on the basis of the extracted authentication data.

Description

  The present invention relates to an authentication system, an authentication method, and a program for packets transmitted and received on a network.

  Usually, in order for a user to use the Internet using a terminal in a private home, it is necessary to subscribe to an Internet connection service provided by a network service provider such as an ISP (Internet Service Provider). By subscribing to such a service, the user can use various services provided by the service provider, such as provision of an e-mail account and provision of content from a portal site. In providing such services, authentication to ensure security between the service provider and the service subscriber in order to prevent unauthorized use of the service by a person other than the service subscriber and impersonation of the service provider. Is required.

  As an authentication method in this case, an authentication protocol such as PAP or CHAP using a user ID and password in PPP (Point to Point Protocol) is well known. This is because when a connection request is made from the service subscriber terminal to the service provider, a user ID and a password are exchanged between the router on the service provider side and the terminal on the service subscriber side. It is confirmed whether or not it is a person. When it is confirmed that the subscriber is a valid subscriber, the service provision router starts to provide the service to the service subscriber terminal. Further, in PPP, the connection status for each user is managed by holding the status of the authentication result of each subscriber and the timing of the next authentication. Furthermore, a communication protocol called PPPoe (PPP over Ethernet (registered trademark)) is also known in order to use the PPP function on the Ethernet (registered trademark). In PPPe, PPP is encapsulated and a tunnel is established between the service providing router and the service subscriber terminal. Further, in PPPoe, authentication using the PPP authentication protocol is performed at the time of tunnel setup, and the status such as the authentication result in each tunnel is managed.

  Patent Document 1 describes an authentication method for preventing spoofing of a transmission source address of a data packet. In the authentication system of Patent Document 1, a packet data address transmitted from a mobile station for establishing a virtual connection is stored in advance in a gateway node. Thereafter, when the gateway node receives a data packet from the mobile station, the source address in the received data packet is compared with the stored packet data address to determine whether the source address is valid. Is done.

JP 2007-259507 A

  Here, in the system of Patent Document 1 and a general PPP or PPPoe authentication system, communication between devices for authentication is required in addition to actual packet transmission / reception, and the mechanism is complicated. Data packets cannot be communicated until the process is completed. In addition, in PPP and PPPoe, it is necessary to manage the status of each subscriber (tunnel) individually, so that the processing capacity required for status management becomes enormous especially when the number of subscribers is large. Scalability becomes a problem.

  Further, in the conventional authentication system as described above, the authentication is often valid for a certain time after the authentication is performed. For this reason, once authenticated subscribers are processed as legitimate subscribers for a certain period of time even if there is unauthorized use such as impersonation thereafter. However, if authentication processing such as a user ID and password is separately performed every time a packet is transmitted and received, the processing overhead increases and affects the packet transfer capability. Furthermore, in the case of the authentication system of Patent Document 1, it is necessary to provide a database or the like for storing packet data addresses in advance for authentication in the gateway node.

  The present invention has been made in view of the above circumstances, does not require an authentication protocol different from packet transmission / reception, and does not affect the packet transfer capability. It is an object of the present invention to provide an authentication system capable of authenticating a recipient, the authentication method, and a program.

  In order to solve the above-mentioned problem, according to the present invention, there is provided an authentication system comprising a first device and a second device connected to the first device via a first network, The apparatus includes an authentication data embedding unit that embeds authentication data in a data packet, and a packet transmission unit that transmits the data packet in which the authentication data is embedded to the second device. A packet receiving unit that receives a data packet from one device, an authentication data extracting unit that extracts authentication data from the received data packet, and a sender or receiver of the data packet based on the extracted authentication data There is provided an authentication system comprising a legitimacy judging unit that judges legitimacy.

  With this configuration, it is possible to authenticate the sender or receiver on a packet basis based on the authentication data embedded in the transmitted / received data packet without providing an authentication protocol different from the packet transmission / reception. become. Thereby, security in data packet communication between the first device and the second device can be ensured.

  In the authentication system, the validity judgment unit of the second device calculates authentication data based on the data packet, and uses the authentication data extracted by the authentication data extraction unit and the calculated authentication data. In comparison, the validity of the sender or receiver of the data packet may be determined. Further, when the extracted authentication data and the calculated authentication data do not match, the validity determination unit determines that the sender or receiver of the data packet is not valid and discards the data packet. It is good also as composition to do.

  The data packet may be encapsulated by an outer header, and the authentication data embedding unit may be configured to embed authentication data in the outer header. In this case, the outer header may be an IPv6 address, and the authentication data embedding unit may embed authentication data in the interface ID portion of the IPv6 address. Alternatively, the outer header may be an IPv4 address, and the authentication data embedding unit may be configured to embed authentication data in the host unit of the IPv4 address. With this configuration, it is possible to embed data for authentication in the data packet without affecting the transmission / reception of the data packet, ensuring security without providing authentication different from the packet transmission / reception. It becomes possible to do.

  The authentication data embedding unit embeds authentication data in the transmission source address of the data packet, and the validity determination unit transmits the data packet based on the authentication data embedded in the transmission source address of the data packet. It is also possible to judge the legitimacy of the person. Alternatively, the authentication data embedding unit embeds the authentication data in the destination address of the data packet, and the validity determination is performed based on the authentication data embedded in the destination address of the data packet. It may be a thing to judge.

  In the authentication system, the second device connects the first network and the second network, further includes a packet transfer unit that transfers the data packet to the second network, and determines the validity. When the extracted authentication data matches the calculated authentication data, the unit determines that the sender or receiver of the data packet is valid and transmits the data packet to the packet transfer unit It is good also as a structure. Thereby, it becomes possible to transfer only the data packet by the sender or the receiver determined to be valid to the second network.

  The first network may be a regional IP network that supports IPv6, the second network may be a public network that supports IPv6, the first network is an IPv4 network, and the second network is an IPv6 network. It may be.

  In the authentication system, the authentication data may be a checksum value obtained from the data packet or a hash value obtained from the data packet. Further, the authentication data may be provided from an authentication server, or may be stored in advance in the first device and the second device.

  Further, the first device may be a service subscriber router, the second device may be a service providing router, the first device is a service providing router, and the second device is a service subscriber router. May be. Furthermore, the first device or the second device may be a mobile terminal device.

  Further, according to the present invention, a first device connected to a second device via a network, an authentication data embedding unit that embeds authentication data in a data packet, and data in which authentication data is embedded A packet transmission unit that transmits a packet to a second device, and a second device connected to the first device via a network, from the first device A packet receiving unit that receives the data packet, an authentication data extracting unit that extracts the authentication data from the received data packet, and the validity of the sender or receiver of the data packet based on the extracted authentication data And a legitimacy judging unit for judging the above.

  According to the present invention, there is also provided an authentication method in a network system including a first device and a second device connected to the first device via a first network, the first method comprising: An authentication data embedding step for embedding the authentication data in the data packet; a packet transmission step for transmitting the data packet in which the authentication data is embedded to the second device; and a data packet from the first device in the second device. A packet receiving step for receiving data, an authentication data extracting step for extracting authentication data from the received data packet, and determining the validity of the sender or receiver of the data packet based on the extracted authentication data And an authenticity determining step.

  Further, according to the present invention, there is provided an authentication method in a first apparatus connected to a second apparatus via a network, wherein an authentication data embedding step for embedding authentication data in a data packet, and authentication data are embedded. A packet transmission step of transmitting the received data packet to a second device, and an authentication method in a second device connected to the first device via a network, A packet receiving step for receiving a data packet from the first device, an authentication data extracting step for extracting authentication data from the received data packet, and a sender of the data packet based on the extracted authentication data Or an authenticity judging step for judging the legitimacy of the recipient.

  Furthermore, the present invention provides a program for causing a computer to execute the authentication method.

  Therefore, according to the present invention, there is provided an authentication system, an authentication method, and a program capable of easily authenticating a sender and a receiver for each packet without requiring an authentication protocol different from packet transmission / reception. can do.

It is the figure which showed the outline of the network structure of the authentication system in embodiment of this invention. It is a figure which shows schematic structure of CPE and the relay router of the authentication system in embodiment of this invention. It is a figure which shows the format of the data packet in embodiment of this invention.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram showing an outline of a network configuration in the authentication system according to the first embodiment of the present invention. As shown in FIG. 1, the authentication system of the present invention includes CPE (Customer Premise Equipment) 2 a and 2 b for connecting terminals 1 a and 1 b, such as PCs in a user's home, to the first network 100, and the first The relay router 5 for connecting the network 100 and the second network 200 to each other. In the present embodiment, the relay router 5 is a service providing router for providing an Internet connection service by ISP. The CPE 2a is a service subscriber router installed in the subscriber premises of the service provided from the service providing router, and the CPE 2b is not subscribed to the service provided from the service providing router. Router.

  In the present embodiment, the first network 100 is a third-party IP network compatible with IPv6 (Internet Protocol Version 6) such as a regional IP network, and the second network 200 is a public network compatible with IPv6 such as the Internet. is there. In the present embodiment, the data packet transmitted from the terminal 1a is transferred by the relay router 5 to the second network 200, which is a public network, via the first network 100, which is a third party IP network. In this case, a tunneling technique called “IPv6 over IPv6” is used between the relay router 5 and the CPE 2a.

  First, in general IPv6 over IPv6 tunneling, the flow of processing when a data packet is transmitted from the terminal 1a to the server 6 on the second network 200 will be described with reference to FIG. First, in IPv6 over IPv6 tunneling, two IPv6 addresses are assigned to the CPE 2a. One is an IPv6 address AD1 assigned by DHCP or RAS in the first network 100, and the other is an IPv6 address AD2 assigned by an ISP as a service provider. Here, the IPv6 address AD1 is an address for transfer within the first network 100 and cannot be used in the second network 200. The IPv6 address AD2 is an address for transfer within the second network 200 and cannot be used in the first network 100.

  Since the terminal 1a transmits the data packet to the server 6 such as a Web server on the second network 200, the data packet is generated based on the IPv6 address AD2 assigned by the ISP and sent to the CPE 2a. Then, in the CPE 2a, the first IPv6 address AD1 for intra-network transfer is added as an outer header of the data packet received from the terminal 1a. That is, the data packet transmitted from the terminal 1a is encapsulated by the IPv6 address AD1. Here, only the prefix of the IPv6 address is assigned to the CPE 2a from DHCP or RAS in the first network 100. The CPE 2a uses the address included in the assigned prefix as its own address. For example, when an IPv6 prefix such as “2100: 100 :: / 48” is assigned, the CPE 2a sets, for example, “2100: 100 :: 1” as its own IPv6 address AD1, and uses that address for the data packet. Encapsulate.

  Subsequently, the data packet encapsulated by the CPE 2 a is transferred through the first network 100 and sent to the relay router 5. Here, routing is performed between the CPE 2 a and the relay router 5 based on the prefix in the IPv6 address AD 1 for transfer within the first network 100. Thereafter, in the relay router 5, the received data packet is decapsulated and transferred from the relay router 5 to the server 6 on the second network 200.

  When a data packet is transmitted as a response to the terminal 1a from the server 6 on the second network 200, the relay router 5 that has received the data packet transmits the data packet to the first network, as with the CPE 2a. Encapsulate with IPv6 address AD1 used for intra-100 transfer. The encapsulated data packet is transferred through the first network 100 and sent to the CPE 2a. Also in this case, since routing is performed between the CPE 2a and the relay router 5 only based on the prefix of the IPv6 address as described above, the data packet having the address included in “2100: 100 :: / 48” as the destination Are all transmitted to the CPE 2a.

  The CPE 2a determines whether the transferred data packet is the address of its own station (that is, “2100: 100 :: 1”). If it is destined for the local station, the data packet is unencapsulated and transferred to the terminal 1a. On the other hand, if the received data packet is not addressed to the own station, the data packet is discarded. Thus, in the present embodiment, tunneling between the CPE 2a and the relay router 5 is realized by performing packet transmission / reception based on the assigned IPv6 address prefix by IPv6 over IPv6 tunneling. That is, in IPv6 over IPv6 tunneling as in this embodiment, negotiation such as authentication based on a user ID or a password is not required between the CPE 2a and the relay router 5, and individual statuses are provided for each service subscriber (CPE). There is no management. A tunnel in which tunnel status management is not performed is called a stateless tunnel.

  Here, since the format of the data packet in IPv6 over IPv6 can be easily known by anyone, in the stateless tunnel as described above, the service provided from the relay router 5 is illegally performed by a malicious person. May be used. For example, as indicated by a broken line arrow in FIG. 1, a user of the terminal 1b who is not a service subscriber illegally sends a data packet to the server 6 using the relay router 5, or a CPE 2b which is a non-subscriber router It is conceivable to impersonate the relay router 5 and receive a packet sent from the CPE 2a illegally. In order to prevent such a situation, in this embodiment, an authentication function based on an algorithm common between the relay router 5 on the service provider side and the CPE 2a on the subscriber side is provided. A configuration for authenticating a person.

  Authentication in units of packets in the present embodiment will be described with reference to FIGS. FIG. 2 is a block diagram showing a schematic configuration of the CPE 2a and the relay router 5 in the present embodiment, and FIG. 3 is a diagram showing a data packet format at each stage. 2 is executed by calling a program stored in a memory (not shown) such as a ROM provided in the CPE 2a and the relay router 5 so that the CPE 2a and the relay router 5 are similarly operated. It may be configured to be executed by a CPU (not shown) provided, or all or part of the processing of each unit is mounted as an ASIC (Application Specific Integrated Circuit) in each device, and realized by hardware by the ASIC It is good also as a structure to be performed.

  In the authentication system of this embodiment, the sender and / or the recipient are authenticated for each data packet transmitted and received. In this case, the sender / recipient is either or both of the CPE 2a and the relay router 5. First, sender authentication will be described. A solid line arrow in FIG. 2 indicates a flow when a data packet is transmitted from the terminal 1 a to the server 6 on the second network 200. In this case, the relay router 5 determines the legitimacy of the sender of the received data packet. First, in the terminal 1a, the data packet 10a shown in FIG. 3A is generated with the server 6 on the second network 200 as the destination. The data packet 10a includes an inner IPv6 header and a payload including an IPv6 transmission source address and a destination address for transfer within the second network 200. The data packet 10a generated in the terminal 1a is transmitted to the CPE 2a.

  In the CPE 2a, the packet receiver 21 receives the data packet 10a. The received data packet 10 a is sent to the authentication data embedding unit 22. In the authentication data embedding unit 22, first, the authentication data generation unit 220 generates data for use in authentication. In the present embodiment, the authentication data generation unit 220 generates a 16-bit checksum value obtained from the data packet 10a as authentication data. Specifically, all the data packets 10a are added in units of 16 bits, and the 1's complement of the lower 16 bits of the total is used as the checksum value. Usually, the checksum value is embedded in the IP header of the data packet and used to check whether the data included in the data packet is falsified or damaged. On the other hand, in this embodiment, as will be described later, the checksum value is used as authentication data in order to determine whether the receiver or sender of the data packet is valid.

  Subsequently, the data packet 10 a is sent to the encapsulation unit 225 together with the authentication data generated by the authentication data generation unit 220. In the encapsulation unit 225, the outer IPv6 header is added to the data packet 10a to obtain the data packet 10b shown in FIG. Here, as described above, in normal IPv6 over IPv6, the IPv6 address AD1 for transfer within the first network 100 is added as the outer IPv6 header. On the other hand, in this embodiment, the IPv6 address AD1 in which the authentication data generated by the authentication data generation unit 220 is embedded is used as the outer IPv6 header.

  FIG. 3C is a diagram illustrating an outer IPv6 header in which authentication data is embedded. The IPv6 address AD1 includes a 128-bit source address and a destination address. The upper 64 bits of the transmission source address and the destination address are a “prefix” (corresponding to “IPv4“ network part ”), and the lower 64 bits are an“ interface ID ”(IPv4“ host part ”indicating a terminal). Is equivalent).

  As described above, only the IPv6 address prefix is assigned to the CPE 2a as the IPv6 address AD1, and routing between the CPE 2a and the relay router 5 is performed based on the prefix. That is, the interface ID part of the IPv6 address AD1 can be freely used in the CPE 2a. Therefore, in the present embodiment, authentication data is embedded in the lower 16 bits of the interface ID portion in the source address of the IPv6 address AD1 to form an outer IPv6 header. Here, all bits of the checksum value used as the authentication data may be 0 or 1. If such authentication data is embedded as it is in the lower 16 bits of the source address, the address may be invalid, so that it may be embedded with a shift of several bits. The checksum value is not limited to 16 bits, and can be appropriately set between 8 and 64 bits that can be embedded in the interface ID portion of the source address. The authentication data embedding unit 22 not only performs the encapsulation after generating the authentication data, but also generates the authentication data after encapsulating and embeds the authentication data, for example. Alternatively, the authentication data may be generated and encapsulated in parallel.

  Thus, the data packet 10 b in which the authentication data is embedded in the authentication data embedding unit 22 is sent to the packet transmission unit 23. The data packet 10 b sent to the packet transmission unit 23 is then routed through the first network 100 based on the prefix of the outer IPv6 header and sent to the relay router 5.

  In the relay router 5, the packet receiver 51 receives the data packet 10 b. The received data packet 10b is sent to the packet authentication unit 54. In the packet authentication unit 54, first, the authentication data extraction unit 540 extracts authentication data from the outer IPv6 header of the received data packet 10b. Specifically, the lower 16 bits of the interface ID portion in the source address of the outer IPv6 header are extracted as authentication data.

  Subsequently, the IPv6 outer header is removed from the data packet 10b, and the encapsulation of the data packet 10b is released. The decapsulated data packet becomes a data packet 10a shown in FIG. The decapsulated data packet 10a is sent to the validity judgment unit 545 together with the extracted authentication data. The validity judgment unit 545 first calculates a checksum value from the data packet 10a. Here, similarly to the authentication data generation unit 220 of the CPE 2a, the data packets 10a are added in units of 16 bits, and the 1's complement of the lower 16 bits of the total is obtained as a checksum value. Here, also in the packet authentication unit 54, the authentication data may be extracted after the checksum value is calculated, and the checksum value calculation and the authentication data extraction may be performed in parallel. .

  Subsequently, the validity determination unit 545 determines whether or not the obtained checksum value matches the extracted authentication data. When the obtained checksum value matches the extracted authentication data, it is determined that the transmission source of the data packet 10 a is valid, and the data packet 10 a is sent to the packet transmission unit 53. On the other hand, if the obtained checksum value does not match the extracted authentication data, it is determined that the transmission source of the data packet 10a is not valid, and the data packet 10a is discarded. The packet transmission unit 53 transfers the received data packet 10a to the second network 200 based on the inner IPv6 header. Then, the data packet 10 a is routed through the second network 200 and sent to the server 6.

  As described above, in the data packet transmitted from the service subscriber router (CPE 2a) which is a legitimate sender, the checksum value obtained by the algorithm common to the relay router 5 on the service provider side is transmitted as authentication data. Since it is embedded in the original address, the relay router 5 determines that it is a valid sender. On the other hand, when a data packet is transmitted from the CPE 2b which is not a valid subscriber to the relay router 5, the authentication data is not embedded in the data packet, so the relay router 5 determines that the data packet is not a valid sender. And destroyed. Thereby, only the data packet 10 a transmitted from the legitimate sender is transferred to the second network 200 from the packet transmission unit 53 of the relay router 5.

  Next, recipient authentication will be described. 2 indicates the flow of processing when a data packet is transmitted as a response from the server 6 on the second network 200 to the terminal 1a. In this case, the legitimacy of the receiver is confirmed by allowing only the legitimate receiver to receive the data packet. First, the server 6 generates a data packet 10 a having the format shown in FIG. 3A as in the case of the terminal 1 a and transfers the data packet 10 a to the relay router 5 via the second network 200. In the relay router 5, the packet receiver 51 receives the data packet 10a. The received data packet 10 a is sent to the authentication data embedding unit 52. In the authentication data embedding unit 52, first, the authentication data generation unit 520 generates data for use in authentication. Specifically, the authentication data generation unit 520 obtains a 16-bit checksum value from the data packet 10a by the same method as the authentication data generation unit 220 of the CPE 2a and uses it as authentication data.

  Subsequently, the data packet 10 a is sent to the encapsulation unit 525 together with the authentication data generated by the authentication data generation unit 520. In the encapsulating unit 525, as in the case of the encapsulating unit 225 of the CPE 2a, as the outer IPv6 header, the IPv6 address AD1 embedded with the authentication data generated by the authentication data generating unit 520 is added to the data packet 10a. Is done. As described above, in order to confirm the validity of the sender, the authentication data embedding unit 22 of the CPE 2a embeds authentication data in the lower 16 bits of the interface ID portion in the “source address” of the outer IPv6 header. On the other hand, in order to confirm the validity of the receiver, the authentication data embedding unit 52, as shown in FIG. 3D, the lower 16 bits of the interface ID portion in the “destination address” of the outer IPv6 header. The authentication data is embedded into the data packet 10c. The authentication data embedding unit 52 may also be configured to generate authentication data after encapsulating and embed the authentication data, or to generate and encapsulate authentication data in parallel. It is good also as a structure to perform.

  Thus, the data packet 10 c in which the authentication data is embedded in the authentication data embedding unit 52 is sent to the packet transmission unit 53. Then, the packet is transmitted from the packet transmission unit 53 to the CPE 2 a via the first network 100. Here, normally, in IPv6, the upstream router of the CPE 2a in the first network 100 performs neighbor discovery in order to identify the address of a node existing on the same segment from the destination address of the outer IPv6 header. Normally, an inquiry about the node having the destination address in the outer IPv6 header of the data packet 10c is made. In this embodiment, authentication data is embedded in the interface ID portion of the destination address. . For this reason, there is no node having a destination address in which the authentication data is embedded, and there is a possibility that the neighbor discovery fails and the data packet is not normally transferred. Therefore, in the present embodiment, when neighbor discovery is received in the CPE 2a, the interface ID in the destination address of the outer IPv6 header is not checked, and if the prefix matches, the corresponding neighbor discovery is responded. Is done. As a result, since the authentication data is embedded in the interface ID portion in the destination address of the outer IPv6 header, even if it is different from the IPv6 address AD1 of the CPE 2a, it is possible to respond normally to neighbor discovery, Packets are forwarded correctly.

  The data packet 10c transferred to the CPE 2a is received by the packet receiver 21. Then, the data packet 10 c received by the packet receiving unit 21 is sent to the packet authentication unit 24. In the packet authentication unit 24, first, the authentication data extraction unit 240 extracts authentication data from the outer IPv6 header of the received data packet 10c. Specifically, the lower 16 bits of the interface ID in the destination address of the outer IPv6 header are extracted as authentication data.

  Subsequently, the IPv6 outer header is removed from the data packet 10c, and the encapsulation of the data packet 10c is released. The decapsulated data packet is a data packet 10a shown in FIG. Then, the data packet 10a is sent to the validity judgment unit 245 together with the extracted authentication data. The validity judgment unit 245 first calculates a checksum value from the data packet 10a. Here, similarly to the authentication data generation unit 520 of the relay router 5, the data packets 10a are added in units of 16 bits, and the 1's complement of the lower 16 bits of the total is obtained as a checksum value. Here, also in the packet authentication unit 24, the authentication data may be extracted after the checksum value is calculated, and the checksum value calculation and the authentication data extraction may be performed in parallel. .

  Then, the validity determination unit 245 determines whether or not the obtained checksum value matches the extracted authentication data. When the obtained checksum value matches the extracted authentication data, The data packet 10 a is sent to the packet transmitter 23. On the other hand, if the obtained checksum value does not match the extracted authentication data, the data packet 10 a is discarded without being sent to the packet transmitter 23. Then, the packet transmitting unit 23 transmits the received data packet 10a to the terminal 1a.

  As described above, the service subscriber router (CPE 2a), which is a legitimate recipient, uses the same algorithm as the relay router 5 on the service provider side, based on the authentication data in the interface ID portion of the destination address, Receive and transfer. On the other hand, the non-subscriber CPE 2b (FIG. 1) does not include the packet authentication unit 24. Therefore, when a data packet is received from the relay router 5, it is determined that the destination is not addressed to the own station because the authentication data is embedded in the outer IPv6 header, and the packet is discarded. In this way, a receiver who is not a valid subscriber cannot receive a data packet from the relay router 5 (service provider), thereby confirming the validity of the receiver.

  Further, when a data packet is transmitted from the CPE 2a to the relay router 5, the authentication data embedding unit 22 of the CPE 2a may embed authentication data in the destination address of the outer IPv6 header. With this configuration, even when the CPE 2b, which is a non-subscriber router, impersonates a service providing router (relay router 5) and attempts to receive a data packet from the CPE 2a illegally, authentication data is displayed in the outer IPv6 header. Is embedded, the CPE 2b determines that the data packet is not destined for the own station, and the packet is discarded, so that unauthorized reception can be prevented. Further, when a data packet is transmitted from the relay router 5 to the CPE 2a, the authentication data embedding unit 52 of the relay router 5 may be configured to embed authentication data in the source address of the outer IPv6 header. The CPE 2a and the relay router 5 may be configured to embed authentication data in both the source address and the destination address of the outer IPv6 header.

  As described above, in the present embodiment, in a stateless tunnel that does not need to individually manage the status of the tunnel, by embedding authentication data that can be recognized only by a service subscriber and a service provider in a transmitted / received data packet, It is possible to ensure security between the relay router 5 on the provider side and the CPE 2a on the service subscription side. Further, by performing authentication by embedding authentication data in the interface ID portion in the outer header of the data packet, it is possible to perform a security check for each packet without suppressing overhead and affecting the packet transfer capability.

  Furthermore, if only the validity of the data included in the data packet is confirmed using the checksum value as in the past, if the data itself is valid, the data from an unauthorized receiver or sender Even packets are sent and received as valid. On the other hand, in the present embodiment, the authenticity of the receiver and the sender is confirmed by embedding the authentication data in the source address or the destination address of the data packet to be transmitted / received, or both. Transmission / reception of data packets from the sender can be prevented.

  In general, when a data packet is transmitted from the relay router 5 to the second network 200, a paid Internet interconnection service called Internet exchange is used. This Internet exchange service employs a pay-per-use system according to traffic (communication volume). In such a case, by providing the authentication system as in the present embodiment, only data packets transmitted from legitimate subscribers can be transmitted from the relay router 5 to the second network 200, and unauthorized users can be transmitted. It is possible to reduce the cost caused by the transmission of the data packet, and as a result, it is possible to reduce the packet communication fee borne by the user.

  Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments and can be modified in various ranges. For example, in the above-described embodiment, the case where IPv6 over IPv6 tunneling is used between the CPE 2a and the relay router 5 has been described. However, in the present invention, authentication between the relay router 5 and the CPE 2a using various tunneling technologies is described. It is applicable to. For example, in FIG. 1, the second network 200 including the subscriber premises where the terminal 1a is located and the access destination server 6 is compatible with IPv6, but the first network 100 is compatible with IPv4 (Internet Protocol Version 4). If it is compatible, a tunneling technique called “IPv6 over IPv4” for performing IPv6 communication via the IPv4 network is used.

  In this IPv6 over IPv4, the IPv6 data packet generated in the terminal 1a is encapsulated by the header of the IPv4 packet in the CPE 2a. By encapsulating the IPv6 data packet with the IPv4 header in this way, it becomes possible to handle an IPv6 packet that cannot be routed by the first network 100 that is an IPv4 network as an IPv4 packet. As one of the IPv6 over IPv4 tunneling techniques, a technique called 6rd (IPv6 rapid deployment) has been developed.

  In 6rd, first, the IPv6 address prefix is assigned to the relay router 5 from the service provider. Then, an IPv4 address is automatically assigned to the CPE 2a from DHCP on the first network 100. At this time, the IPv6 prefix of the relay router 5 is also notified to the CPE 2a. The CPE 2a composes an IPv6 address by combining the notified IPv6 prefix and the IPv4 address, and the IPv6 address of the terminal 1a is assigned based on the IPv6 address generated by the CPE 2a. When a data packet is transmitted from the terminal 1a to the second network 200, an outer IPv4 header is added to the IPv6 data packet generated by the terminal 1a by the CPE 2a and transferred to the relay router 5. . Further, routing is performed between the CPE 2a and the relay router 5 by an outer IPv4 header based on the IPv6 prefix assigned to the relay router 5. As described above, the tunnel in 6rd is also a stateless tunnel in which the user ID and password are not authenticated between the CPE 2a and the relay router 5, and individual status management is not performed in each tunnel.

  When the authentication system of the present invention is applied to such IPv6 over IPv4 tunneling including 6rd, in the authentication data embedding unit 22 or 52 of the CPE 2a or the relay router 5, the source address and / or the destination of the outer IPv4 header The authentication data may be embedded in the host part of the address (corresponding to the “interface ID part” of IPv6). However, since the host part of the source address and destination address of the IPv4 header has only 32 bits, the number of bits of the authentication data is appropriately set to 32 bits or less. Then, the packet authentication unit 24 or 54 of the CPE 2a or the relay router 5 determines the validity of the sender / receiver based on the authentication data embedded in the host part of the outer IPv4 header.

  Furthermore, the present invention can be applied to other stateless tunnels such as IPv4 over IPv6 and IPv4 over IPv4. Also in these cases, authentication data is embedded in the interface ID part or the host part of the source address and / or the destination address of the outer IPv6 header (in the case of IPv4 over IPv6) or the outer IPv4 header (in the case of IPv4 over IPv4), respectively. Then, the legitimacy of the sender / receiver is confirmed based on the authentication data.

  In the above embodiment, the checksum value of the data packet is used as the authentication data. However, the present invention is not limited to this, and various values that can be extracted based on the data packet are authenticated. It can be used as business data. For example, a hash value may be obtained from a data packet using a hash function common to the CPE 2a and the relay router 5, and the hash value may be used as authentication data. Furthermore, signatures calculated based on data packets and encrypted data obtained by other encryption techniques can also be used as authentication data.

  Further, the first network 100 includes an authentication server, and the authentication server provides an authentication key such as a hash key to be used as authentication data to the CPE 2a and the relay router 5, and provides a service. When providing a router to a service subscriber from a subscriber, it is also possible to store a predetermined authentication key in the router in advance. In this case, the authentication data generation units 220 and 520 of the authentication data embedding units 22 and 52 need only read the authentication key provided from the authentication server or stored in advance, and generate the authentication data. There is no need. Also, the validity determination units 245 and 545 in the packet authentication units 24 and 54 do not need to calculate authentication data, and the authentication key may be read and compared with the extracted authentication data.

  In the above embodiment, the authentication data is embedded and determined for all packets. However, the present invention is not limited to this, and the result of authentication once and the validity are confirmed. It is also possible to store the transmission source information of the data packet that has been sent, and then transfer the data packet without performing authentication processing. In the above embodiment, the authentication data is embedded in the outer header of the data packet encapsulated in the tunneling technique. However, the present invention is not limited to this. For example, even if the authentication data is embedded in the destination address / source address of the data packet not employing the tunneling technique (not encapsulated) or the destination address / source address in the inner header of the encapsulated data packet, Similar to the embodiment, the validity of the sender / receiver in packet units can be confirmed. In the relay router 5 or the CPE 2a, it is also effective to store a log of data packets that are judged to be not data packets from a valid transmission source by the validity judgment unit. By storing the log in this way, it becomes possible to identify an unauthorized user based on the log.

  Further, in the above embodiment, the CPE 2a of the service subscriber router is configured to embed authentication data in the transmission packet and authenticate the reception packet. However, the terminal 1a embeds authentication data, and The configuration may be such that the received packet is authenticated, and the CPE 2a may be a portable terminal having a relay function.

1a, 1b terminal 2a, 2b CPE
5 Relay router 6 Server 21, 51 Packet receiving unit 22, 52 Authentication data embedding unit 220, 520 Authentication data generation unit 225, 525 Encapsulation unit 23, 53 Packet transmission unit 24, 54 Packet authentication unit 240, 540 For authentication Data extraction unit 245, 545 Validity determination unit 100 First network 200 Second network

Claims (21)

An authentication system comprising a first device and a second device connected to the first device via a first network,
The first device includes:
An authentication data embedding unit for embedding authentication data in the data packet;
A packet transmission unit that transmits the data packet in which the authentication data is embedded to the second device,
The second device includes:
A packet receiver that receives the data packet from the first device;
An authentication data extraction unit for extracting authentication data from the received data packet;
An authentication system comprising: a validity determination unit that determines the validity of the sender or receiver of the data packet based on the extracted authentication data.   The validity judgment unit calculates authentication data based on the data packet, compares the authentication data extracted by the authentication data extraction unit with the calculated authentication data, The authentication system according to claim 1, wherein validity of the sender or the receiver is determined.   When the extracted authentication data and the calculated authentication data do not match, the validity determination unit determines that the sender or receiver of the data packet is not valid, and determines the data packet The authentication system according to claim 2, wherein the authentication system is discarded.   4. The data packet according to claim 1, wherein the data packet is encapsulated by an outer header, and the authentication data embedding unit embeds the authentication data in the outer header. 5. The authentication system described in. The outer header is an IPv6 address,
The authentication system according to claim 4, wherein the authentication data embedding unit embeds the authentication data in an interface ID portion of the IPv6 address. The outer header is an IPv4 address,
The authentication system according to claim 4, wherein the authentication data embedding unit embeds the authentication data in a host unit of the IPv4 address. The authentication data embedding unit embeds the authentication data in a transmission source address of the data packet,
The said validity judgment part judges the sender's legitimacy of the said data packet based on the data for authentication embedded in the transmission source address of the said data packet, Any one of Claim 1 to 6 characterized by the above-mentioned. The authentication system according to claim 1. The authentication data embedding unit embeds the authentication data in a destination address of the data packet,
8. The validity determination according to claim 1, wherein the validity is determined based on authentication data embedded in a destination address of the data packet. The authentication system described in the section. The second device connects the first network and the second network, and further includes a packet transfer unit that transfers the data packet to the second network,
The validity judgment unit judges that the sender or receiver of the data packet is valid when the extracted authentication data matches the calculated authentication data, and the data packet The authentication system according to any one of claims 2 to 8, wherein the authentication system is transmitted to the packet transfer unit.   The first network is a regional IP network compatible with IPv6, and the second network is a public network compatible with IPv6, or the first network is an IPv4 network, and the second network is IPv6. The authentication system according to claim 9, wherein the authentication system is a network.   The authentication system according to any one of claims 1 to 10, wherein the authentication data is a checksum value or a hash value obtained from the data packet.   The authentication system according to any one of claims 1 to 10, wherein the authentication data is provided from an authentication server.   The authentication system according to claim 1, wherein the authentication data is stored in advance in the first device and the second device.   The first device is a service subscriber router and the second device is a service providing router, or the first device is a service providing router and the second device is a service subscriber router. The authentication system according to any one of claims 1 to 13, wherein the authentication system is any one of the following.   The authentication system according to any one of claims 1 to 13, wherein the first device or the second device is a mobile terminal device. A first device connected to a second device via a network,
An authentication data embedding unit for embedding authentication data in the data packet;
A packet transmission unit configured to transmit the data packet in which the authentication data is embedded to the second device; A second device connected to the first device via a network,
A packet receiver for receiving data packets from the first device;
An authentication data extraction unit for extracting authentication data from the received data packet;
An apparatus comprising: a legitimacy judging unit that judges legitimacy of a sender or a receiver of the data packet based on the extracted authentication data. An authentication method in a network system comprising a first device and a second device connected to the first device via a first network,
In the first device,
An authentication data embedding step for embedding the authentication data in the data packet;
A packet transmission step of transmitting the data packet in which the authentication data is embedded to the second device;
In the second device,
A packet receiving step for receiving the data packet from the first device;
An authentication data extraction step for extracting authentication data from the received data packet;
And a legitimacy judging step of judging legitimacy of a sender or a receiver of the data packet based on the extracted authentication data. An authentication method in a first device connected to a second device via a network,
An authentication data embedding step for embedding authentication data in the data packet;
A packet transmission step of transmitting the data packet in which the authentication data is embedded to the second device. An authentication method in a second device connected to the first device via a network,
Receiving a data packet from the first device; and
An authentication data extraction step for extracting authentication data from the received data packet;
And a legitimacy judging step of judging legitimacy of a sender or a receiver of the data packet based on the extracted authentication data.   A program for causing a computer to execute the authentication method according to claim 19 or 20.

Images